upgrade to BCryptPasswordEncoder